Emir Beganovic
c97836e4f2
The install test's key sits in the user's home, which is its own subvolume and not part of the factory snapshot, and the seal removes it there. The check says so of every image, instead of leaving it to the layout staying as it is.
50 lines
3.5 KiB
Bash
Executable File
50 lines
3.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Boots a sealed image once, as a throwaway machine, and checks that it is
|
|
# what vm-seal promises: a desktop that comes up, nothing of the build left
|
|
# in it, and SSH that takes keys only. Exits non-zero on any failed check.
|
|
#
|
|
# vm-verify <sealed_dir>
|
|
set -euo pipefail
|
|
[[ $# -eq 1 ]] || { echo "Usage: vm-verify <sealed_dir>" >&2; exit 2; }
|
|
here=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
base=$(realpath "$1")
|
|
( cd "$base" && sha256sum --quiet -c SHA256SUMS )
|
|
uuid=$(cat /proc/sys/kernel/random/uuid)
|
|
export VM_UUID=$uuid SSH_PORT=$(( 20000 + RANDOM % 10000 ))
|
|
|
|
VM_PW=${GUEST_PASSWORD:-omarchy} "$here/vm-boot" "$base" "WANT_ID=${uuid//-/} PW=${GUEST_PASSWORD:-omarchy} bash -s" <<'GUEST'
|
|
fail=0
|
|
check() { # description, then a command that must succeed
|
|
local what=$1; shift
|
|
if "$@" >/dev/null 2>&1; then echo "ok $what"; else echo "FAIL $what"; fail=1; fi
|
|
}
|
|
root() { printf '%s\n' "$PW" | sudo -S -p '' "$@"; }
|
|
booted=$(( $(date +%s) - $(cut -d. -f1 /proc/uptime) - 5 ))
|
|
newer() { [ "$(root stat -c %Y "$1")" -ge "$booted" ]; } # written by this boot
|
|
|
|
check "the system reaches running or degraded" \
|
|
sh -c 's=$(timeout 120 systemctl is-system-running --wait); [ "$s" = running ] || [ "$s" = degraded ]'
|
|
check "no unit failed" sh -c '[ -z "$(systemctl --failed --no-legend)" ]'
|
|
check "a desktop session is logged in" sh -c 'for i in $(seq 1 60); do pgrep -x Hyprland && exit 0; sleep 0.5; done; exit 1'
|
|
check "the machine ID is the one this boot was given" [ "$(cat /etc/machine-id)" = "$WANT_ID" ]
|
|
check "the journal holds this machine only" [ "$(root ls /var/log/journal | tr '\n' ' ')" = "$WANT_ID " ]
|
|
check "SSH refuses passwords" sh -c "printf '%s\n' '$PW' | sudo -S -p '' sshd -T | grep -qix 'passwordauthentication no'"
|
|
check "SSH requires a key" sh -c "printf '%s\n' '$PW' | sudo -S -p '' sshd -T | grep -qix 'authenticationmethods publickey'"
|
|
# Asking with no method makes sshd list the ones it would take.
|
|
check "sshd offers a key as the only way in" \
|
|
sh -c 'ssh -o PreferredAuthentications=none -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null omarchy@127.0.0.1 true 2>&1 | grep -qF "Permission denied (publickey)."'
|
|
check "authorized_keys holds one key, this boot's" [ "$(grep -c . ~/.ssh/authorized_keys)" = 1 ]
|
|
check "SSH host keys were made by this boot" newer /etc/ssh/ssh_host_ed25519_key
|
|
check "NetworkManager's key was made by this boot" newer /var/lib/NetworkManager/secret_key
|
|
check "one DHCP lease, this boot's" [ "$(root sh -c 'ls /var/lib/NetworkManager/*.lease | wc -l')" = 1 ]
|
|
check "no shell history" sh -c '! [ -e ~/.bash_history ]'
|
|
check "the package cache is empty" [ -z "$(ls /var/cache/pacman/pkg)" ]
|
|
root mkdir -p /run/top && root mount -o subvolid=5,ro "$(findmnt -no SOURCE / | sed 's/\[.*//')" /run/top
|
|
check "the factory snapshot has no machine ID" sh -c "! printf '%s\n' '$PW' | sudo -S -p '' test -s /run/top/@factory/etc/machine-id"
|
|
check "the factory snapshot holds no SSH login key" sh -c "! printf '%s\n' '$PW' | sudo -S -p '' sh -c 'ls /run/top/@factory/root/.ssh/authorized_keys /run/top/@factory/home/*/.ssh/authorized_keys' 2>/dev/null | grep -q ."
|
|
check "the factory snapshot has no SSH host keys" sh -c "[ -z \"\$(printf '%s\n' '$PW' | sudo -S -p '' sh -c 'ls /run/top/@factory/etc/ssh/ssh_host_* 2>/dev/null')\" ]"
|
|
check "no snapshots besides the current system" [ -z "$(root ls /.snapshots)" ]
|
|
echo "omarchy $(pacman -Q omarchy 2>/dev/null | cut -d' ' -f2), kernel $(uname -r), $(systemd-analyze | head -1)"
|
|
exit $fail
|
|
GUEST
|